Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

// // //
4/30/2018
09:35 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now

Insider Threats Cost Enterprises More Than $8M Every Year Report

Insider threats, whether it's an employee with malicious intent or a worker is simply careless, can cost enterprises more than $8 million over the course of 12 months to clean up, according to a new report.

Insider threats, whether it's an employee looking to steal data to sell or simply a case of worker carelessness or neglect, are costing enterprises more and more money every year to clean up, according to a new report.

Specifically, enterprises are spending on average about $8.76 million during the course of a 12-month period to clean up from the damage that an insider security threat can cause.

It usually takes about two months to clean up from one of these incidents.

These and other findings are contained in a report "2018 Cost of Insider Threats: Global Organizations," conducted by the Ponemon Institute and sponsored by ObserveIT, a startup that specializes in employee monitoring and behavior analytics software for enterprise.

(Source: iStock)
(Source: iStock)

The study, released on April 24, is based on interviews with 717 securities practitioners from around the world, who reported more than 3,200 insider incidents over the course of the past year.

While outsider attacks, such as Advanced Persistent Threats (APTs), which are usually conducted by nation-states involved in espionage, draw the most attention, the report is a reminder to enterprises that some of the biggest threats are lurking around the cubicle corner of every office. (See APTs Are Rising in the East, Kaspersky Finds.)

For instance, in the past week, SunTrust Bank of Atlanta has started an investigation into whether a former employee possibly took personal data from customers. Overall, the company had to notify about $1.5 million customers of the possible theft, and offer credit monitoring. (See SunTrust Investigation Shows Continuing Threats Posed by Insiders.)

Over the last two years, insider threat clean-up costs increased over 100% from $4.3 million to the $8.76 million figure found in the last report. (The original 2016 Ponemon report only included US costs, while the new one released this month included global numbers.)

Since 2016, Ponemon estimates that the number of security incidents involving employee or contractor negligence has increased by 26%. At the same time, malicious or criminal intent, like the possible theft SunTrust in investigating, increased by nearly 53%.

Despite the rise in malicious insider attacks, it's still the negligent insider who is the cause of most security problems, with 64% of incidents related to carelessness and 23% tied to nefarious activities.

"The careless insider is frequently caused by employees or contractors who are simply trying to bypass broken or undocumented business practices to better accomplish their task, without regard for the potential ramifications of exposing internal data in inappropriate ways," ObserveIT CEO Mike McKee wrote in an email to Security Now.

"The malicious insider, however, is actively working to better understand your internal cybersecurity defenses and processes and how best to bypass them in order to avoid detection/prevention," McKee added. "The result of the insider threat and ultimate costs (value of data, lost productivity, fines, etc.) are often more complex and much higher than the careless insider case."


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

The biggest problem with insider threats is the loss or theft of company credentials. In fact the number of these incidents has doubled over the past two years, increasing by a staggering 170%, according to Ponemon.

In addition, size matters. Enterprises with more than 75,000 employees spent $20 million over the last year to resolve insider security lapses. Those companies with less than 500 workers spent about $1.8 million.

McKee added that regulations, such as the European Union's General Data Protection Regulation (GDPR) and US privacy laws, are also increasing costs to enterprises when it comes to insider clean-up. (See GDPR Compliance: Enterprises Have Two Options to Consider.)

Unsurprisingly, financial services spent the most on average to fix insider problems. On average it cost these enterprises about $12 million to resolve. Energy and utilities spent about $10 million and retail shelled out $8.8 million.

Finally, the report notes that large businesses in North America spent on average about $11 million last year to resolve these issues. That's more than enterprises in Asia-Pacific -- $5.9 million -- and Europe and the Middle East -- $7 million.

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file